The present invention relates to a control system for controlling safety-critical processes, having a first control unit for controlling safety-critical processes and at least one signal unit linked to the safety-critical processes via I/O channels, and further having a field bus connecting the first control unit and the signal unit, and a bus master for controlling communication on the field bus, said first control unit and said signal unit comprising safety-directed arrangements for ensuring failsafe communication among each other.
Use of field buses for data communication between separate units involved in the control of a process is sufficiently known today in control and automation technology. The term field bus is used in this connection to describe a data communication system to which, ideally, any desired units can be connected that communicate with each other via the common field bus. Communication between the units is governed by specified protocols. Such a communication system is in contrast to a point-to-point communication link between two units where other units are completely cut off from the communication between such units. Examples of known field buses are the so-called CANbus, Profibus or Interbus.
In many field buses, communication is controlled by at least one bus master that is primary to the other units connected to the field bus, designated here as stations. This has the result that no data can be sent by any station to any other station without xe2x80x9cpermissionxe2x80x9d and control of the bus master. Usually, the bus master is a standard module which implements the protocols specified for the field bus, and which is often relatively complex and, thus, considerably expensive.
Although the use of field buses offers numerous advantages, mainly with respect to the high cabling effort that would otherwise be required, it was not possible heretofore to employ field buses in practical use for controlling safety-critical processes. The reason is that due to their structure being freely accessible for any units, the degree of failsafety necessary for controlling safety-critical processes could not be guaranteed.
The term safety-critical process is understood in the present invention to describe a process which, in case of a fault, would present a risk for people and goods that may not be neglected. Ideally, it must be 100% guaranteed for any safety-critical process that the process will be transferred to a safe state in case a fault should occur. Such safety-critical process may also be partial processes of larger, higher-level overall processes. Examples for safety-critical processes are chemical processes, where it is an absolute necessity to keep critical parameters within predetermined limits, or complex machine controls, such as the control of a hydraulic press or of an entire production line. In the case of a hydraulic press, for example, the material feeding process may be a non-safety-critical partial process, whereas the process of starting the pressing tool may be a safety-critical partial process, as part of the overall process. Other examples of (partial) safety-critical processes are the monitoring of guards, protective doors or light barriers, the control of two-hand switches or the reaction to emergency shut-down devices.
DE 197 42 716 A1 discloses a control and data transmission system, which is based on a field bus, especially the one known as Interbus, and which had for its object to integrate safety-directed modules. It was proposed to achieve this object by implementing safety-directed arrangements in both the bus master, designated as master control unit in the cited publication, and the stations. In addition to the data communication as such, the safety-directed arrangements perform safety functions that guarantee the required failsafety with respect to the control of safety-critical processes. To say it in more concrete terms, the required safety is achieved in this case mainly by making the bus master xe2x80x9csafexe2x80x9d through implementing safety-directed arrangements.
However, implementing such arrangements is very laborious and costly in the development and construction of a failsafe control system, since one cannot make use of standard modules for this purpose any longer, but is required to develop the complex bus master as such.
In addition, such an approach is of disadvantage also in operation of a control system based thereon, because in the control of complex processes the safety-directed communication amounts to only 10% of the whole communication volume. The known approach leads therefore to the disadvantage that the bus master is made xe2x80x9csafexe2x80x9d at high expense, although this is not necessary for 90% and more of the communication volume controlled by it.
It is an object of the present invention to provide a control system that provides failsafe communication between units involved in controlling a safety-critical process.
It is another object of the present invention to provide a control system for controlling safety-critical processes that can be build up using standard modules as bus masters.
It is another object of the present invention to provide a control system for controlling safety-critical processes having a control unit and a plurality of signal units, wherein said control unit can communicate with said signal units across a field bus without simultaneously having bus master functionality.
These objects are particularly achieved with a control system as mentioned at the outset, wherein the bus master is connected to the field bus independently of the first control unit and the plurality of signal units.
Due to the safety-directed arrangements, the first control unit is a xe2x80x9csafexe2x80x9d control unit, which means that it is in a position to determine, and to correct, both internal and external faults, if necessary by interaction with other safe units. To say it in more concrete terms, this feature means that the first control unit for controlling safety-critical processes on the one hand and the bus master on the other hand are accommodated in separate modules, and they are both connected to the field bus separately. It is feasible to connect the first control unit to the field bus as a simple station, i.e. without any bus master functionality, as will be described hereafter with reference to the Interbus, by way of example. The control of the safety-critical process can then be effected largely independently of the control of any non-safety-critical processes, and also independently of the control of data communication on a common field bus.
The control unit does therefore not require any bus master functionality, and conversely the bus master can be connected to the field bus without any safety-directed arrangements. This allows the use of conventional standard bus master modules.
The invention further provides the advantage that the first control unit, and with it the safety-directed arrangements, have to be adapted only to the comparatively small volume of safety-directed data traffic, as regards their complexity and speed. The portion of non-safety-directed data traffic, which may amount to 90 % and more in a complex overall process, need not be handled via the first control unit or via the safety-directed arrangements. Accordingly, the first control unit and the safety-directed arrangements can be given a relatively simple structure.
According to an embodiment of the above-mentioned feature, the first control unit comprises an independent control program for controlling the safety-critical process.
In this connection, the term independent control program is meant to describe a control program that puts the first control unit in a position to control the safety-critical process independently of other control units. The first control unit, therefore, instead of being merely a redundant element supplementing another control unit, is in a position to control the safety-critical process independently and in a failsafe manner. The feature is especially advantageous insofar as it provides complete separation of the safety-directed parts of the control system from the non-safety-critical parts. This is of particular importance in connection with the certification of a control system by the competent supervision authorities because any influence on the safety-directed part by manipulation of the non-safety-directed part is excluded in this way.
According to a further embodiment, the first control unit is capable of generating a failsafe bus telegram the receipt of which causes the signal unit to transfer the safety-critical process to a safe state.
If the safety-critical process concerns, for example, the monitoring of an emergency shut-down device, a safe state may be reached, for example, by immediately de-energizing the whole process. In the case of a chemical production system making the entire system dead might, however, permit uncontrolled reactions to take place so that in this case the term safe state is defined as the setting of predetermined parameter ranges. The described measure is in contrast to the solution that realizes the transfer of the process to a safe state via additional control lines, separate from the field bus. This was preferred heretofore because a failsafe bus telegram is possible only in conjunction with safety-directed arrangements. In contrast, the described measure provides the advantage that it is now possible to work without corresponding additional control lines, whereby the cabling effort is once more reduced.
According to a another embodiment, the safety-directed arrangements comprise a multi-channel structure.
The term multi-channel structure as used in this connection means that the safety-directed arrangements comprise at least two parallel processing channels that are redundant one with respect to the other. This feature provides the advantage that a fault occurring in one of the processing channels can be discovered, for example, by the fact that one result deviates from the results of the other processing channel or channels, and can then be corrected, if necessary. Thus, this feature contributes in a very reliable manner to ward improving failsafety.
Preferably, the multi-channel structure is based on the diversity principle.
This means that the different channels of the multi-channel structure are built up differently. For example, one channel may be based on a microcontroller from one manufacturer, while another channel is based on a microcontroller from a second manufacturer. Accordingly, the control programs of the micro-controllers will also differ one from the other in that case. Alternatively, one of the channels may have a hard-wired logic, instead of a microcontroller. The described feature provides the advantage that failsafety is once more considerably improved due to the fact that the probability of the same faults occurring at the same time is considerably reduced in structures of a diverse nature, compared with homogenous structures.
According to a further embodiment of the invention, the control system comprises a second control unit for controlling non-safety-critical processes.
Preferably, the second control unit is a standard control unit, i.e. a control unit available as a standard module. This feature is particularly advantageous where the control system is to be employed for controlling complex overall processes as in this case all non-safety-critical processes can be controlled separately from the safety-critical partial processes. In addition, the first control unit can be relieved of non-safety-critical tasks. This allows the first control unit and, in addition, the entire control system to be given an especially low-cost and efficient design.
According to a further development of the before-mentioned measure, the second control unit is connected to the field bus separately from the first control unit.
This feature provides the advantage that safety-directed processes are separated even more strictly from non-safety-directed processes, which reduces the risk that the safety-directed controls may be influenced unintentionally still further. Moreover, it is thus rendered possible to retrofit a first control unit for controlling safety-critical processes in an existing overall system, without having to exchange a standard control unit previously used in that control system. This permits existing control systems that include safety-directed components to be retrofitted easily and at low cost.
According to a further embodiment of the measures described before, the second control unit is free from safety-directed arrangements.
This means that the second control unit does not comprise safety-directed arrangements. This feature provides the advantage that the second control unit, too, is kept free of unnecessary ballast. This permits low-cost standard modules to be used for the second control unit.
According to a further embodiment of the feature discussed before, the bus master is incorporated in the second control unit.
This feature provides the advantage that it reduces the number of units connected to the field bus employed. Moreover, control units with integrated bus master are available as standard modules from different manufacturers. Consequently, the described feature can be implemented at low cost and efficiently.
According to a further embodiment of the invention, the field bus provides circulating telegram traffic between different units connected to the field bus. To this end, the field bus, preferably, is an Interbus.
Field buses with circulating telegram traffic are known as such in the art. The Interbus, used by preference, may serve as an example in this connection. In principle, such field buses are designed in the manner of a shift register where the units connected to the field bus are the sequentially arranged storage positions. Controlled by the bus master, a data word is sequentially shifted from one unit to the next. Due to suitable measures, which may be different for different field buses, a connected unit will recognize that a shifted bus telegram contains portions intended for it.
The described feature provides the advantage that it permits a very efficient control system to be implemented in a simple way and with extremely low cabling effort. The use of an Interbus as field bus moreover provides the advantage that a unit is capable of identifying bus telegrams intended for it in an especially simple way. This makes the system little susceptible to faults.
According to a further embodiment of the invention, the first control unit is arranged upstream of the signal unit, relative to the circulating direction of the telegram traffic.
This feature is especially advantageous insofar as it guarantees, in a simple way, that the signal unit will receive only such data that have been generated by the first control unit.
According to a further embodiment of the previously described measure, the first control unit comprises means for replacing any telegram data, addressed to the signal unit, by failsafe telegram data.
The described feature is a very simple and, thus, advantageous way of guaranteeing that the signal unit involved in a safety-critical process will exclusively receive failsafe telegram data. To say it in more concrete terms, the sequentially circulating telegram traffic is utilized for this purpose insofar as a telegram is permitted to reach the specified signal unit only if it was generated by the first control unit.
According to a further embodiment of the invention, the control system comprises at least two first control units for controlling at least two safety-critical processes.
This feature provides the possibility to control very complex overall processes, comprising different safety-critical partial processes, individually and independently one from the other and in an extremely simple and low-cost way. It is a particular advantage in this connection that none of the first control units is required to have a bus master functionality, which contributes to keeping the cost of the overall system low.
It is understood that the features recited above and those yet to be explained below can be used not only in the respective combination indicated, but also in other combinations or in isolation, without leaving the context of the present invention.